How to prevent ransomware

Today’s ransomware prevention is defined by operational resilience rather than technical containment. Why do so many attacks still succeed even when organizations patch systems, train employees, and keep backups? And why do small and mid‑sized businesses (SMB) continue to absorb the biggest impact? 

This article breaks down how modern ransomware actually works today, why traditional defenses such as backups often fall short, and what a practical, layered prevention strategy looks like when attackers optimize for disruption instead of just encryption.

Key points of this article:

• Ransomware remains a dominant threat for small and mid-size organizations.
• Verizon’s 2026 Data Breach Investigations Report shows that System Intrusion is the top breach pattern for SMBs, and that approximately 96% of ransomware victims were SMBs.
• Modern ransomware is no longer defined by file encryption alone. Business disruption, operational downtime, and reputational damage are now the primary objectives.
• First and foremost, prevention must account for data extortion, as many groups steal sensitive data first, and apply pressure even without deploying ransomware.
• Initial access often comes from exploited vulnerabilities and stolen credentials, making patching and identity protection foundational controls.
• Backups reduce ransomware impact only when attackers can’t access or tamper with them. Authorities consistently warn that ransomware actors deliberately target backups to block recovery and increase leverage.
• The most effective strategies are layered: reduce entry points, detect malicious behavior early, and recover quickly with verified restore paths.
• A practical framework for businesses is simple: prevent, detect and respond, and recover.

What ransomware is today, and why prevention is harder than it used to be

Modern ransomware operations frequently combine encryption with data theft and extortion, sometimes relying on data extortion alone—a trend highlighted by the Cybersecurity and Infrastructure Security Agency (CISA).

Ransomware development itself is also becoming more adaptive. ESET researchers observed this shift via PromptLock, a proof of concept ransomware capable of using generative AI to dynamically create malicious scripts for scanning, encrypting, or exfiltrating files. Yet, the implication for businesses is far from the idea that attackers suddenly need less skill. Instead, it tells us that tooling can evolve faster—making static defenses less reliable and increasing the importance of layered prevention and behavior based detection.

Attackers are moving faster and relying on scalable access paths rather than noisy malware delivery. Verizon’s 2026 DBIR shows that exploitation of vulnerabilities has become the leading initial access vector, rising to 31% of breaches—up from 20% the previous year—while credential abuse declined to 13%. This shift reflects a playbook optimized for speed, scale, and reduced detection. 

How ransomware attacks usually unfold in a business environment

Most ransomware incidents are multi-stage intrusions that progress from initial access to escalation, lateral movement, and ultimately business disruption. Availability loss and downtime are the primary impacts that are meant to lead to ultimate monetization of prior access. This process aligns with what many incident responders describe as faster, multi-surface intrusions, where attackers exploit gaps in visibility and trusted relationships.  

Mapped to MITRE ATT&CK, this progression commonly includes credential abuse through Valid Accounts (T1078), initial access or persistence via External Remote Services such as VPN or RDP gateways (T1133), and lateral movement using Remote Services (T1021) already present in the environment. The techniques themselves rely on legitimate access paths that blend easily into normal IT activity.

The initial access story has become more consistent across various data and sources:

• From the vendor-neutral comparison perspective, the most common initial access vectors worldwide were exploitations of internet‑facing applications and the use of valid credentials, among others.
• Verizon’s 2026 DBIR shows that vulnerability exploitation has overtaken credential abuse as the leading initial access vector, while stolen credentials remain pervasive across breach paths even when they are not the first point of entry.

The way ransomware attacks usually unfold delineates why generic prevention advice tends to underperform: the strongest improvements happen when defenses are mapped to how attackers progress through business environments.

Phishing, malicious links, and employee targeted social engineering

Email still fuels many ransomware intrusions, especially when phishing becomes credential theft, rather than obvious malware delivery. Verizon’s 2026 DBIR shows that social engineering remains a major driver of breaches, accounting for 16% of all breaches, with the human element present in 62%. 

Over the last couple of years, business email compromise (BEC) has evolved from crude spoofing into a low noise, high confidence fraud tactic. Rather than relying on malware, attackers impersonate executives, vendors, or partners to trigger urgent actions such as wire transfers, invoice changes, or credential handovers. 

These attacks increasingly exploit compromised or look-alike email accounts, making them harder to detect with traditional security controls. The result is a form of fraud that scales quietly, targets trust rather than technology, and causes financial loss without ever deploying malicious code.

According to Verizon, while email-based phishing remains dominant, 41% of social engineering breaches now involve non-email vectors, such as voice and text messaging. Phishing simulations further show that mobile-centric lures have 40% higher median click rates than traditional email, underscoring the continued effectiveness of credential-harvesting attacks.

Also, embedded links now dominate malicious spam, accounting for 86% of campaigns. This reflects a deliberate pivot toward credential‑harvesting landing pages that are more likely to bypass traditional scanning controls. At the same time, QR‑code phishing, also known as quishing, rose significantly between 2023 and 2025, capitalizing on user trust in QR codes and the limited visibility into destination URLs on mobile devices.

What can be done to improve your resilience:

• Employee awareness must reflect how attackers gain access today, through impersonation and credential theft, rather than obvious malware. 
• Reporting of incidents must be easy and fast. Attacker timelines compress when the first suspicious message is surfaced quickly, which can dramatically reduce potential damage. Exact procedures for how employees are expected to act right after an incident happens must be understood by everyone.

At ESET, we understand employee training and cloud app protection as a vital part of the prevention stack because phishing commonly bridges identity compromise and SaaS abuse.

The best way is continuous education through ESET Cybersecurity Awareness Training, combined with protection for Microsoft 365 and Google Workspace email and collaboration tools through ESET Cloud Office Security, where credential harvesting attacks often begin.

Remote access, stolen credentials, and lateral movement

Once credentials are stolen, attackers often enter through “normal” doors: unsecure VPN, webmail, remote desktop gateways, and cloud admin portals. 

MITRE ATT&CK documents credential abuse (“Valid Accounts”) as a technique used for initial access, persistence, and lateral movement, allowing attackers to move between systems while appearing legitimate. 

From there, they enumerate the environment, pivot to additional hosts, and seek higher‑privilege accounts, often reusing access paths that administrators themselves rely on. Because attackers rely on legitimate access paths, identity‑level controls play a critical role in limiting lateral movement once credentials are stolen.

Government advisories consistently emphasize this expansion phase. For example, CISA’s ransomware advisory highlights mitigations such as patching, network segmentation, and restricting risky access paths, which are controls explicitly aimed at preventing attackers from turning an initial foothold into a broader, network‑wide compromise.

Encryption, data extortion, and double extortion

The goal of a ransomware attack can be practically defined in three points:

• Encryption: Attackers encrypt systems and data, making them unusable until a ransom is paid for a decryption key. Imagine it this way: someone walks into your office overnight and replaces every lock on every door; you still own the building, but you can’t get in to do business.
• Data extortion: Attackers steal data and use the threat of exposure as leverage, sometimes without encrypting systems at all. Conceive of this as: someone secretly photocopies your most sensitive documents and then calls to say, “Pay us, or everyone will see what we took,” even though your doors were never locked. 
• Double extortion: In addition to encrypting systems, attackers steal sensitive data and threaten to leak it if payment isn’t made. Let’s say it this way: not only are you locked out of your office, but the intruder also copied your filing cabinets and threatens to publish their contents unless you pay.

How to prevent ransomware: the control stack that matters most

While the main measure working against ransomware attacks is backups, which reduce operational impact in pure encryption attacks and support recovery in double extortion scenarios, an effective prevention strategy requires controls that stop an attack before backups would be required.

There is broad agreement across the cybersecurity community on prevention’s fundamentals: reduce initial access, harden identity, limit spread through segmentation, maintain resilient backups, and rehearse response. 

Backing up backups?

It’s important to recognize that relying on “we have backups” only addresses one slice of the problem: backups can restore availability, but they don’t reverse data theft, regulatory exposure, or customer trust impact once sensitive data leaves the environment.

This consensus is reflected across vendors, independent institutions, and analysts, and provides a solid baseline for how to think about ransomware defense.

Success, however, depends on moving from principle to practice. What follows is a practical stack for SMBs, with each control mapped to a specific attacker advantage it removes. This can help you understand the problem conceptually while staying grounded in real‑world, day‑to‑day operations.

1) Enforce multi-factor authentication (MFA) on every high risk entry point

Prioritize webmail, VPN, privileged/admin accounts, cloud admin consoles, and remote access tooling. For instance, CISA guidelines repeatedly put MFA at the center of reducing impact and likelihood, especially for services exposed to the internet.

At ESET, we see MFA as essential in preventing ransomware, as it is a critical component in a multilayered defense strategy. MFA acts as a vital barrier that stops unauthorized users even if they possess the correct password. ESET Secure Authentication, an easy-to-use and effective mobile-based MFA solution that protects organizations from weak passwords and unauthorized access, prevents data breaches, helps you meet compliance requirements, and allows you to make use of a fully fledged cloud deployment.

2) Patch internet facing systems and known exploited software

For most businesses, effective patching is less about perfection and more about prioritization: externally exposed services, remote access infrastructure, and widely used applications should come first.

ESET Vulnerability & Patch Management helps organizations identify vulnerable software and simplify remediation through centralized visibility and automated patching. Through the ESET PROTECT Console, security teams can manage patching policies centrally and apply them consistently to endpoints (like servers and mobile devices, for instance). Role-based access controls within the console ensure administrators have the appropriate permissions, while centralized policy deployment helps reduce risk from unpatched systems. 

3) Protect email, collaboration apps, and cloud identities

URL-heavy phishing means email security must focus on link analysis, impersonation, and credential theft patterns instead of just attachment scanning. The same lures increasingly spill into collaboration platforms, where chat messages, shared files, and meeting invites can carry malicious links that appear routine and trusted. 

In parallel, stolen cloud identities turn SaaS portals and admin consoles into high‑value targets, allowing attackers to move laterally across email, collaboration tools, and business applications without deploying malware at all.

ESET addresses this with a unified approach built around ESET Cloud Office Security, protecting email and collaboration platforms against phishing, impersonation, and malicious links, combined with MFA (as mentioned earlier) to harden cloud and remote access.

4) Reduce attack surface across endpoints

Attack surface reduction works best when it includes consistent prevention layers and behavior monitoring across endpoints. Visibility into abnormal process execution, privilege use, and lateral movement is as important as blocking known malware.

ESET pairs multilayered endpoint and server prevention with behavioral detection and centralized visibility to expose malicious behavior. By combining strong default prevention on endpoints with XDR‑driven monitoring to surface suspicious activity, ESET actively helps shrink the exposed surface.

This visibility is critical for ransomware defense, where attackers frequently change tooling and staging to evade static signatures. ESET’s Ransomware Shield monitors for and evaluates running processes based on behavior and reputation, detecting and blocking activity that resembles ransomware in real time. 

Together, attack‑surface reduction and behavior‑based ransomware protection constitutes a continuous control, from limiting what attackers can abuse to interrupting damage when prevention alone is not enough.

5) Segment networks so one infection doesn’t become an organization wide outage

Network segmentation reduces lateral movement and limits the blast radius when an attacker gains an initial foothold. Various ransomware guidelines consistently recommend network segmentation for reasons that are bulletproof: it prevents a single compromised system from cascading into a full operational outage.

ESET approaches segmentation through a multi‑layered model that combines host‑based micro segmentation, automated endpoint isolation, and behavioral monitoring. Delivered through ESET PROTECT, this device‑level segmentation ensures that even if one machine is compromised, its ability to reach others is restricted, containing incidents before they spread. 

6) Train employees to spot tactics that lead to ransomware

As discussed earlier, training is most effective when it focuses on the lures employees actually encounter, be it internal impersonation, HR- or IT‑themed messages, or URL‑based credential prompts. Generic advice alone is insufficient when phishing increasingly targets trust and routine workflows.

ESET strengthens the human layer through continuous education with ESET Cybersecurity Awareness Training, paired with technical controls in ESET Cloud Office Security to protect Microsoft 365 and Google Workspace, where many credential‑harvesting attacks begin.

Backups are necessary, but not enough

Backups are a core ransomware resilience control, but attackers actively try to remove them from the decision tree. For small and mid‑sized businesses, what’s at stake is often prolonged downtime and irreversible data loss. Ransomware groups are highly adaptive in how they set demands, and they tend to view SMBs as easier targets, particularly because smaller organizations are less likely to maintain current, readily recoverable backups at the same level as larger enterprises.

In 2024, 94% of organizations said attackers tried to compromise their backups during a ransomware attack. Verizon’s 2026 DBIR reinforces that availability disruption is a central impact of ransomware, with improved coding now capturing prolonged operational interruption, highlighting that recovery remains uncertain under attack conditions.

For SMBs, this shifts backup strategy toward the 3 2 1, or even better a 3 2 1 1 0 model, which extends traditional backup strategy by requiring an immutable or offline copy and zero‑error restore testing, acknowledging that ransomware now actively targets backup systems. The 3‑2‑1‑1‑0 model shifts backups from a compliance artifact to a resilience control.

This operational view is reinforced by NIST’s Ransomware Risk Management: A Cybersecurity Framework 2.0 Community Profile, which treats ransomware readiness as a coordinated set of protect, detect, respond, and recover objectives rather than a single control. 

NIST explicitly stresses the need to verify the integrity of backups, test recovery processes, and validate response assumptions in advance, recognizing that ransomware incidents unfold under extreme time pressure and uncertainty. In this model, recovery is an actively exercised capability that must hold up during real attacks instead of just in theory.

Closing the loop: what “enough” actually looks like

Having backups is table stakes; resilience depends on whether they survive attack conditions and can be restored quickly and confidently.

For SMBs in particular, this means designing backups to withstand deliberate sabotage, validating restores regularly, and integrating recovery into broader incident response planning. Anything less leaves recovery to chance, and hands ransomware operators the leverage they are explicitly trying to create.

Recovery belongs in prevention strategy

The final outcome of an attack is defined by what happens after that foothold is established, especially under time pressure. That distinction matters because disruption is the dominant outcome: IBM’s 2025 Cost of a Data Breach report found that 86% of businesses experienced operational disruption following a data breach, underscoring how recovery performance ultimately determines impact. 

Prolonged outages create leverage even when data can eventually be restored. Organizations that can isolate affected systems, recover cleanly, and resume operations quickly reduce both the blast radius and the attacker’s negotiating power. In practice, recovery capability shapes attacker incentives just as much as perimeter defenses. This is exactly why CISA packages prevention guidance together with a response checklist rather than treating them as separate topics.

How ESET approaches ransomware recovery differently

ESET approaches recovery as an integrated component of ransomware defense, rather than a separate afterthought. It’s based on resilient recovery and automated remediation, enabled through proprietary rollback technology that operates independently of Microsoft Volume Shadow Copy Service, reducing reliance on mechanisms that attackers frequently target or disable.

At the technical level, Ransomware Remediation is designed to work in concert with the Ransomware Shield. When suspicious activity is detected, the endpoint creates on‑the‑fly backups of user-selected files; if the process is later confirmed as malicious, those files are automatically restored to their original locations. 

This endpoint‑level recovery capability is intended to address the earliest stages of encryption attempts, complementing traditional backup and disaster‑recovery strategies by limiting damage before broader restoration workflows are required.

When businesses need MDR for ransomware prevention

SMBs often don’t have 24/7 monitoring, threat hunting capacity, or incident response depth. Meanwhile, according to Verizon’s 2026 DBIR, system intrusion remains the dominant breach pattern, accounting for approximately 60% of all breaches and totaling 14,309 incidents in the latest reporting period. These intrusions are overwhelmingly driven by external actors (88%), with financial motivation remaining primary and espionage accounting for roughly 15% of breaches. 

The impact has shifted decisively toward internal environments, with 67% of breaches involving internal data, alongside credentials (28%) and sensitive secrets (13%), underscoring the depth and operational significance of modern intrusions.

These shifts underscore why continuous monitoring and guided response through MDR become essential once attacks move beyond initial access. Managed Detection and Response (MDR) is a practical bridge for SMBs as it provides exactly this without requiring a full internal SOC. ESET’s MDR is a 24/7 service combining AI-powered automation with human expertise, including monitoring, threat hunting, containment, eradication actions, and tailored reporting. In practice, MDR closes the coverage gaps most SMB teams can’t staff around the clock.

How an effective ransomware prevention strategy helps businesses

Preventing ransomware is about reducing the likelihood that an initial mistake, exposed system, or stolen credential turns into a full business disruption.

Effective ransomware prevention requires practical, end to end strategy that reflects how modern attacks unfold, why identity and cloud services now play a central role, and where traditional approaches, such as relying on backups alone, often fall short.

A strong ransomware prevention strategy helps organizations understand how layered controls work together: limiting common entry points, detecting malicious activity early, and maintaining the ability to recover operations quickly and confidently. Once this is fully understood and adopted, the result is a clearer view of what matters most for reducing ransomware risk in real business environments.

FAQs for schema-ready implementation

How can ransomware be prevented?

Ransomware prevention relies on layered risk reduction rather than a single control. Effective prevention focuses on securing identities with MFA, rapidly patching internet‑facing systems, protecting email and cloud services, limiting lateral movement, and detecting malicious behavior early. Since modern attacks often include data theft and extortion, prevention must extend beyond stopping file encryption alone.

Is there one best protection against ransomware?

No single control can stop ransomware by itself. Strong protection combines identity hardening, attack‑surface reduction, behavior‑based detection, and recovery readiness. Together, these layers reduce the likelihood of initial access and limit the impact if attackers gain a foothold.

What is the 3‑2‑1 rule for ransomware backups?

The 3‑2‑1 rule means keeping three copies of data, on two different media types, with one copy stored offsite. In ransomware scenarios, many organizations extend this to a 3‑2‑1‑1‑0 approach by adding an immutable or offline copy and regularly testing restores to ensure backups remain usable under real attack conditions.

Can backups prevent ransomware attacks?

Backups don’t prevent ransomware attacks, but they are critical for recovery. In many incidents, attackers deliberately target and disable backups to increase pressure. Backups are most effective when isolated from production systems, protected from tampering, and routinely tested to confirm reliable restoration.

Why is MFA important for ransomware prevention?

Stolen credentials are one of the most common entry points for ransomware operators. MFA reduces the usefulness of leaked passwords by requiring an additional verification factor for access to VPNs, webmail, cloud admin portals, and remote desktops. This significantly limits credential‑only intrusions.

How does phishing lead to ransomware?

Phishing typically leads to ransomware by enabling credential theft rather than delivering malware directly. Once attackers obtain valid logins, they can access systems through legitimate services, move laterally, steal data, and later deploy ransomware or extortion tactics.

Should a business pay the ransomware demand?

Paying a ransom doesn’t guarantee data recovery and can increase the risk of repeat targeting. While ransom payments aren’t universally prohibited, they can expose organizations to sanctions and regulatory  or legal risks depending on jurisdiction and circumstances. Effective preparation focuses on ensuring payment isn’t the only option by enabling rapid containment, resilient recovery, and the ability to resume operations without negotiating with attackers.

What makes modern ransomware different from older ransomware?

Modern ransomware commonly combines system encryption with data theft and extortion, and some campaigns rely on data extortion alone. This evolution shifts prevention away from malware blocking alone toward identity protection, visibility into attacker behavior, and rapid response capabilities.